@inkeep/agents-core 0.0.0-dev-20260219033751 → 0.0.0-dev-20260219045007

package/dist/data-access/runtime/conversations.d.ts

@@ -16,19 +16,19 @@ declare const listConversations: (db: AgentsRunDatabaseClient) => (params: {
 }>;
 declare const createConversation: (db: AgentsRunDatabaseClient) => (params: ConversationInsert) => Promise<{
   id: string;
-  tenantId: string;
-  projectId: string;
-  agentId: string | null;
-  title: string | null;
   createdAt: string;
   updatedAt: string;
-  metadata: ConversationMetadata | null;
   ref: {
     type: "commit" | "tag" | "branch";
     name: string;
     hash: string;
   } | null;
   userId: string | null;
+  metadata: ConversationMetadata | null;
+  title: string | null;
+  tenantId: string;
+  projectId: string;
+  agentId: string | null;
   activeSubAgentId: string;
   lastContextResolution: string | null;
 }>;
@@ -85,19 +85,19 @@ declare const getConversation: (db: AgentsRunDatabaseClient) => (params: {
   conversationId: string;
 }) => Promise<{
   id: string;
-  tenantId: string;
-  projectId: string;
-  agentId: string | null;
-  title: string | null;
   createdAt: string;
   updatedAt: string;
-  metadata: ConversationMetadata | null;
   ref: {
     type: "commit" | "tag" | "branch";
     name: string;
     hash: string;
   } | null;
   userId: string | null;
+  metadata: ConversationMetadata | null;
+  title: string | null;
+  tenantId: string;
+  projectId: string;
+  agentId: string | null;
   activeSubAgentId: string;
   lastContextResolution: string | null;
 } | undefined>;
@@ -121,19 +121,19 @@ declare const createOrGetConversation: (db: AgentsRunDatabaseClient) => (input:
   contextConfigId?: string | undefined;
 } | {
   id: string;
-  tenantId: string;
-  projectId: string;
-  agentId: string | null;
-  title: string | null;
   createdAt: string;
   updatedAt: string;
-  metadata: ConversationMetadata | null;
   ref: {
     type: "commit" | "tag" | "branch";
     name: string;
     hash: string;
   } | null;
   userId: string | null;
+  metadata: ConversationMetadata | null;
+  title: string | null;
+  tenantId: string;
+  projectId: string;
+  agentId: string | null;
   activeSubAgentId: string;
   lastContextResolution: string | null;
 }>;
@@ -153,19 +153,19 @@ declare const getActiveAgentForConversation: (db: AgentsRunDatabaseClient) => (p
   conversationId: string;
 }) => Promise<{
   id: string;
-  tenantId: string;
-  projectId: string;
-  agentId: string | null;
-  title: string | null;
   createdAt: string;
   updatedAt: string;
-  metadata: ConversationMetadata | null;
   ref: {
     type: "commit" | "tag" | "branch";
     name: string;
     hash: string;
   } | null;
   userId: string | null;
+  metadata: ConversationMetadata | null;
+  title: string | null;
+  tenantId: string;
+  projectId: string;
+  agentId: string | null;
   activeSubAgentId: string;
   lastContextResolution: string | null;
 } | undefined>;

package/dist/data-access/runtime/messages.d.ts

@@ -10,13 +10,13 @@ declare const getMessageById: (db: AgentsRunDatabaseClient) => (params: {
   messageId: string;
 }) => Promise<{
   id: string;
-  tenantId: string;
-  projectId: string;
   createdAt: string;
   updatedAt: string;
   metadata: MessageMetadata | null;
-  content: MessageContent;
   role: string;
+  content: MessageContent;
+  tenantId: string;
+  projectId: string;
   fromSubAgentId: string | null;
   toSubAgentId: string | null;
   fromExternalAgentId: string | null;
@@ -141,13 +141,13 @@ declare const getVisibleMessages: (db: AgentsRunDatabaseClient) => (params: {
 }[]>;
 declare const createMessage: (db: AgentsRunDatabaseClient) => (params: MessageInsert) => Promise<{
   id: string;
-  tenantId: string;
-  projectId: string;
   createdAt: string;
   updatedAt: string;
   metadata: MessageMetadata | null;
-  content: MessageContent;
   role: string;
+  content: MessageContent;
+  tenantId: string;
+  projectId: string;
   fromSubAgentId: string | null;
   toSubAgentId: string | null;
   fromExternalAgentId: string | null;
@@ -194,13 +194,13 @@ declare const deleteMessage: (db: AgentsRunDatabaseClient) => (params: {
   messageId: string;
 }) => Promise<{
   id: string;
-  tenantId: string;
-  projectId: string;
   createdAt: string;
   updatedAt: string;
   metadata: MessageMetadata | null;
-  content: MessageContent;
   role: string;
+  content: MessageContent;
+  tenantId: string;
+  projectId: string;
   fromSubAgentId: string | null;
   toSubAgentId: string | null;
   fromExternalAgentId: string | null;

package/dist/data-access/runtime/scheduledTriggerInvocations.d.ts

@@ -34,7 +34,7 @@ declare const listScheduledTriggerInvocationsPaginated: (db: AgentsRunDatabaseCl
 }) => Promise<{
   data: {
     scheduledTriggerId: string;
-    status: "pending" | "running" | "completed" | "failed" | "cancelled";
+    status: "pending" | "failed" | "running" | "completed" | "cancelled";
     scheduledFor: string;
     startedAt: string | null;
     completedAt: string | null;
@@ -174,7 +174,7 @@ declare const listUpcomingInvocationsForAgentPaginated: (db: AgentsRunDatabaseCl
 }) => Promise<{
   data: {
     scheduledTriggerId: string;
-    status: "pending" | "running" | "completed" | "failed" | "cancelled";
+    status: "pending" | "failed" | "running" | "completed" | "cancelled";
     scheduledFor: string;
     startedAt: string | null;
     completedAt: string | null;
@@ -208,7 +208,7 @@ declare const listProjectScheduledTriggerInvocationsPaginated: (db: AgentsRunDat
 }) => Promise<{
   data: {
     scheduledTriggerId: string;
-    status: "pending" | "running" | "completed" | "failed" | "cancelled";
+    status: "pending" | "failed" | "running" | "completed" | "cancelled";
     scheduledFor: string;
     startedAt: string | null;
     completedAt: string | null;

package/dist/data-access/runtime/tasks.d.ts

@@ -7,19 +7,19 @@ import { TaskInsert, TaskSelect } from "../../types/entities.js";
 //#region src/data-access/runtime/tasks.d.ts
 declare const createTask: (db: AgentsRunDatabaseClient) => (params: TaskInsert) => Promise<{
   id: string;
-  tenantId: string;
-  projectId: string;
-  agentId: string;
   createdAt: string;
   updatedAt: string;
-  metadata: TaskMetadataConfig | null;
   ref: {
     type: "commit" | "tag" | "branch";
     name: string;
     hash: string;
   } | null;
+  metadata: TaskMetadataConfig | null;
   status: string;
+  tenantId: string;
+  projectId: string;
   subAgentId: string;
+  agentId: string;
   contextId: string;
 }>;
 declare const getTask: (db: AgentsRunDatabaseClient) => (params: {

package/dist/db/manage/manage-schema.d.ts

@@ -814,13 +814,13 @@ declare const triggers: drizzle_orm_pg_core1479.PgTableWithColumns<{
         algorithm: "sha256" | "sha512" | "sha384" | "sha1" | "md5";
         encoding: "hex" | "base64";
         signature: {
-          source: "query" | "header" | "body";
+          source: "query" | "body" | "header";
           key: string;
           prefix?: string | undefined;
           regex?: string | undefined;
         };
         signedComponents: {
-          source: "literal" | "header" | "body";
+          source: "literal" | "body" | "header";
           required: boolean;
           key?: string | undefined;
           value?: string | undefined;
@@ -851,13 +851,13 @@ declare const triggers: drizzle_orm_pg_core1479.PgTableWithColumns<{
         algorithm: "sha256" | "sha512" | "sha384" | "sha1" | "md5";
         encoding: "hex" | "base64";
         signature: {
-          source: "query" | "header" | "body";
+          source: "query" | "body" | "header";
           key: string;
           prefix?: string | undefined;
           regex?: string | undefined;
         };
         signedComponents: {
-          source: "literal" | "header" | "body";
+          source: "literal" | "body" | "header";
           required: boolean;
           key?: string | undefined;
           value?: string | undefined;

package/dist/db/runtime/runtime-schema.d.ts

@@ -1778,7 +1778,7 @@ declare const scheduledTriggerInvocations: drizzle_orm_pg_core1831.PgTableWithCo
       tableName: "scheduled_trigger_invocations";
       dataType: "string";
       columnType: "PgVarchar";
-      data: "pending" | "running" | "completed" | "failed" | "cancelled";
+      data: "pending" | "failed" | "running" | "completed" | "cancelled";
       driverParam: string;
       notNull: true;
       hasDefault: false;
@@ -1791,7 +1791,7 @@ declare const scheduledTriggerInvocations: drizzle_orm_pg_core1831.PgTableWithCo
       generated: undefined;
     }, {}, {
       length: 50;
-      $type: "pending" | "running" | "completed" | "failed" | "cancelled";
+      $type: "pending" | "failed" | "running" | "completed" | "cancelled";
     }>;
     scheduledFor: drizzle_orm_pg_core1831.PgColumn<{
       name: "scheduled_for";

package/dist/middleware/authz-meta.d.ts

@@ -0,0 +1,15 @@
+import { MiddlewareHandler } from "hono";
+
+//#region src/middleware/authz-meta.d.ts
+type AuthzMeta = {
+  resource?: string;
+  permission?: string;
+  description: string;
+};
+type ProjectScopedMiddleware = MiddlewareHandler & {
+  readonly __projectScoped: true;
+};
+declare function getAuthzMeta(mw: unknown): AuthzMeta | undefined;
+declare function registerAuthzMeta(mw: object, meta: AuthzMeta): void;
+//#endregion
+export { AuthzMeta, ProjectScopedMiddleware, getAuthzMeta, registerAuthzMeta };

package/dist/middleware/authz-meta.js

@@ -0,0 +1,11 @@
+//#region src/middleware/authz-meta.ts
+const authzMeta = /* @__PURE__ */ new WeakMap();
+function getAuthzMeta(mw) {
+	return typeof mw === "function" ? authzMeta.get(mw) : void 0;
+}
+function registerAuthzMeta(mw, meta) {
+	authzMeta.set(mw, meta);
+}
+
+//#endregion
+export { getAuthzMeta, registerAuthzMeta };

package/dist/middleware/create-protected-route.d.ts

@@ -0,0 +1,30 @@
+import { ProjectScopedMiddleware } from "./authz-meta.js";
+import { createRoute } from "@hono/zod-openapi";
+import { ZodType } from "zod";
+import { MiddlewareHandler } from "hono";
+
+//#region src/middleware/create-protected-route.d.ts
+type CreateRouteParams = Parameters<typeof createRoute>[0];
+declare function createProtectedRoute<T extends CreateRouteParams>(config: T & {
+  permission: ProjectScopedMiddleware;
+  request: {
+    params: ZodType<{
+      projectId: string;
+    }>;
+  };
+}): T;
+declare function createProtectedRoute<T extends CreateRouteParams>(config: T & {
+  permission: ProjectScopedMiddleware;
+  request: {
+    params: ZodType<{
+      id: string;
+    }>;
+  };
+}): T;
+declare function createProtectedRoute<T extends CreateRouteParams>(config: T & {
+  permission: MiddlewareHandler & {
+    __projectScoped?: never;
+  };
+}): T;
+//#endregion
+export { createProtectedRoute };

package/dist/middleware/create-protected-route.js

@@ -0,0 +1,20 @@
+import { getAuthzMeta } from "./authz-meta.js";
+
+//#region src/middleware/create-protected-route.ts
+function toArray(value) {
+	if (!value) return [];
+	return Array.isArray(value) ? value : [value];
+}
+function createProtectedRoute(config) {
+	const { permission, ...routeConfig } = config;
+	const meta = getAuthzMeta(permission);
+	return {
+		...routeConfig,
+		middleware: [permission, ...toArray(routeConfig.middleware)],
+		...meta && { "x-authz": meta },
+		...!meta && !("security" in config) && { security: [] }
+	};
+}
+
+//#endregion
+export { createProtectedRoute };

package/dist/middleware/index.d.ts

@@ -0,0 +1,5 @@
+import { AuthzMeta, ProjectScopedMiddleware, getAuthzMeta, registerAuthzMeta } from "./authz-meta.js";
+import { createProtectedRoute } from "./create-protected-route.js";
+import { inheritedAuth, inheritedManageTenantAuth, inheritedRunApiKeyAuth, inheritedWorkAppsAuth } from "./inherited-auth.js";
+import { noAuth } from "./no-auth.js";
+export { type AuthzMeta, type ProjectScopedMiddleware, createProtectedRoute, getAuthzMeta, inheritedAuth, inheritedManageTenantAuth, inheritedRunApiKeyAuth, inheritedWorkAppsAuth, noAuth, registerAuthzMeta };

package/dist/middleware/index.js

@@ -0,0 +1,6 @@
+import { getAuthzMeta, registerAuthzMeta } from "./authz-meta.js";
+import { createProtectedRoute } from "./create-protected-route.js";
+import { inheritedAuth, inheritedManageTenantAuth, inheritedRunApiKeyAuth, inheritedWorkAppsAuth } from "./inherited-auth.js";
+import { noAuth } from "./no-auth.js";
+
+export { createProtectedRoute, getAuthzMeta, inheritedAuth, inheritedManageTenantAuth, inheritedRunApiKeyAuth, inheritedWorkAppsAuth, noAuth, registerAuthzMeta };

package/dist/middleware/inherited-auth.d.ts

@@ -0,0 +1,43 @@
+import * as hono0 from "hono";
+
+//#region src/middleware/inherited-auth.d.ts
+
+/**
+ * Documentation-only permission marker for routes whose authentication
+ * is already enforced by a parent `app.use()` in createApp.ts.
+ *
+ * This does NOT perform any auth check itself — it only registers
+ * x-authz metadata so the OpenAPI spec accurately reflects the
+ * auth requirement.
+ *
+ * Use this when the route lives under a path that already has
+ * middleware applied (e.g. `/manage/tenants/*` has `manageApiKeyOrSessionAuth`).
+ */
+declare const inheritedAuth: (meta: {
+  resource?: string;
+  permission?: string;
+  description: string;
+}) => hono0.MiddlewareHandler<any, string, {}, Response>;
+/**
+ * Marker for routes under `/manage/tenants/*` whose auth is handled
+ * by `manageApiKeyOrSessionAuth()` in createApp.ts.
+ *
+ * No auth check runs at the route level — this is purely for OpenAPI documentation.
+ */
+declare const inheritedManageTenantAuth: () => hono0.MiddlewareHandler<any, string, {}, Response>;
+/**
+ * Marker for routes under `/run/*` whose auth is handled
+ * by `runApiKeyAuth()` in createApp.ts.
+ *
+ * No auth check runs at the route level — this is purely for OpenAPI documentation.
+ */
+declare const inheritedRunApiKeyAuth: () => hono0.MiddlewareHandler<any, string, {}, Response>;
+/**
+ * Marker for routes under `/work-apps/*` whose auth is handled
+ * by `workAppsAuth()` in createApp.ts.
+ *
+ * No auth check runs at the route level — this is purely for OpenAPI documentation.
+ */
+declare const inheritedWorkAppsAuth: () => hono0.MiddlewareHandler<any, string, {}, Response>;
+//#endregion
+export { inheritedAuth, inheritedManageTenantAuth, inheritedRunApiKeyAuth, inheritedWorkAppsAuth };

package/dist/middleware/inherited-auth.js

@@ -0,0 +1,50 @@
+import { registerAuthzMeta } from "./authz-meta.js";
+import { createMiddleware } from "hono/factory";
+
+//#region src/middleware/inherited-auth.ts
+/**
+* Documentation-only permission marker for routes whose authentication
+* is already enforced by a parent `app.use()` in createApp.ts.
+*
+* This does NOT perform any auth check itself — it only registers
+* x-authz metadata so the OpenAPI spec accurately reflects the
+* auth requirement.
+*
+* Use this when the route lives under a path that already has
+* middleware applied (e.g. `/manage/tenants/*` has `manageApiKeyOrSessionAuth`).
+*/
+const inheritedAuth = (meta) => {
+	const mw = createMiddleware(async (_c, next) => {
+		await next();
+	});
+	registerAuthzMeta(mw, meta);
+	return mw;
+};
+/**
+* Marker for routes under `/manage/tenants/*` whose auth is handled
+* by `manageApiKeyOrSessionAuth()` in createApp.ts.
+*
+* No auth check runs at the route level — this is purely for OpenAPI documentation.
+*/
+const inheritedManageTenantAuth = () => inheritedAuth({
+	resource: "organization",
+	permission: "member",
+	description: "Requires organization membership. Auth is enforced by the manageApiKeyOrSessionAuth middleware in createApp.ts."
+});
+/**
+* Marker for routes under `/run/*` whose auth is handled
+* by `runApiKeyAuth()` in createApp.ts.
+*
+* No auth check runs at the route level — this is purely for OpenAPI documentation.
+*/
+const inheritedRunApiKeyAuth = () => inheritedAuth({ description: "Requires a valid API key (Bearer token). Auth is enforced by runApiKeyAuth middleware in createApp.ts." });
+/**
+* Marker for routes under `/work-apps/*` whose auth is handled
+* by `workAppsAuth()` in createApp.ts.
+*
+* No auth check runs at the route level — this is purely for OpenAPI documentation.
+*/
+const inheritedWorkAppsAuth = () => inheritedAuth({ description: "Requires work-apps authentication (OIDC token or Slack signature). Auth is enforced by workAppsAuth middleware in createApp.ts." });
+
+//#endregion
+export { inheritedAuth, inheritedManageTenantAuth, inheritedRunApiKeyAuth, inheritedWorkAppsAuth };

package/dist/middleware/no-auth.d.ts

@@ -0,0 +1,6 @@
+import * as hono3 from "hono";
+
+//#region src/middleware/no-auth.d.ts
+declare const noAuth: () => hono3.MiddlewareHandler<any, string, {}, Response>;
+//#endregion
+export { noAuth };

package/dist/middleware/no-auth.js

@@ -0,0 +1,11 @@
+import { createMiddleware } from "hono/factory";
+
+//#region src/middleware/no-auth.ts
+const noAuth = () => {
+	return createMiddleware(async (_c, next) => {
+		await next();
+	});
+};
+
+//#endregion
+export { noAuth };

package/dist/setup/index.d.ts

@@ -0,0 +1,2 @@
+import { SetupConfig, SetupPushConfig, runSetup } from "./setup.js";
+export { type SetupConfig, type SetupPushConfig, runSetup };

package/dist/setup/index.js

@@ -0,0 +1,3 @@
+import { runSetup } from "./setup.js";
+
+export { runSetup };

package/dist/setup/setup.d.ts

@@ -0,0 +1,24 @@
+//#region src/setup/setup.d.ts
+interface SetupPushConfig {
+  projectPath: string;
+  configPath: string;
+  apiKey?: string;
+}
+interface SetupConfig {
+  dockerComposeFile: string;
+  manageMigrateCommand: string;
+  runMigrateCommand: string;
+  authInitCommand: string;
+  pushProject?: SetupPushConfig;
+  devApiCommand?: string;
+  devUiCommand?: string;
+  apiHealthUrl?: string;
+  uiHealthUrl?: string;
+  isCloud?: boolean;
+  skipPush?: boolean;
+  /** If set, upgrades packages instead of just migrating on subsequent runs */
+  upgradeCommand?: string;
+}
+declare function runSetup(config: SetupConfig): Promise<void>;
+//#endregion
+export { SetupConfig, SetupPushConfig, runSetup };